JP4818559B2 - How to operate a conditional access system to the broadcasting sector - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a method for operating a conditional access system for the broadcast field, wherein the conditional access system has many subscribers, each subscriber having a conditional access module and a safety device for storing rights. Where the source signal is encrypted using a first key (Cw), the first key (Cw) is changed at high speed, and the encrypted source signal is Broadcasted for reception by the terminal, and a rights control message (ECM) is transmitted to the safety device, which uses the first key (Cw) encrypted with the service key (P _T ). And a rights management message (EMM) is sent to the security device that supplies the service key (P _T ) necessary to decrypt the encrypted first key (Cw) and in an illegal manner The pirated source device used is the first The different keys required to obtain one key are tracked by sending them to different terminals or groups of terminals and monitoring important information given by pirates.
[0002]
[Background Art and Problems to be Solved by the Invention]
Conditional access systems for the broadcast sector are used, for example, when operating pay television that must be subscribed to gain the right to view channels, services and events. Because of the large number of subscribers and, as a result, the number of security devices that are distributed between subscribers, the security devices are subject to attacks by illegal persons who attempt to derive the only key of the security device. The safety device is usually given in the form of a smart card. If an illegal person or pirate succeeds in pulling out the only key, the smart card will be breached and the pirate can distribute a global key across the Internet, but this key, for example, joins the pirate A first key or a second key for setting the user's network.
[0003]
If the service provider recognizes that the conditional access system has been breached, one or more smart cards that have been breached must be tracked. A well-known method for tracking a breached smart card is to apply a so-called binary search based on the issued smart card. According to this well-known method, the wrong key is transmitted to half of the smart card and the correct key is transmitted to the other half. Pirates can issue the wrong or correct key on the Internet and squeeze from the key issued by the pirate to half of what the pirated card belongs to. In the next step, the wrong key is fired again in half of this half that I found based on the smart card, the correct key is fired in the other half, and again half of the breached card is located Can be guessed from the keys emitted by the pirates. By repeating these steps, a smart card that has been breached can be located and switched. The disadvantage of such a binary search method is that the screen remains dark for legitimate subscribers while the search is being performed. If such exploratory behavior is required repeatedly and lasts for a long time, this will make the subscriber unhappy.
[0004]
The present invention aims to provide a method as described above that limits or completely avoids the occurrence of screen darkness under legal subscribers.
[0005]
[Means for Solving the Problems]
For this purpose, the method according to the invention is such that a search EMM is transmitted to at least half of the terminal, said search EMM supplying at least a service key (P _T ) and a dummy key (P _D1 or P _D2 ), and at least a supply EMM. Comprises an identifier identifying the key (P _T and P _D1 or P _D2 ), where the first search EMM and the key (P _T and P _D1 ) are transmitted to the first part of the terminal and the second The search EMM and key (P _T and P _D2 ) are sent to the second part of the terminal, where the service key used to decrypt the encrypted first key (Cw) is identified. The ECM is sent to all safety devices shortly before the first key (Cw) needs to decrypt the source signal.
[0006]
In this manner, at all legitimate subscribers, the secure device identifies the service key used to decrypt the first key at a time before the first key is needed to decrypt the source signal. Receive. Therefore, a legitimate subscriber will not have a black screen. However, once the pirate receives an identification of the service key to be used, the pirate does not have enough time to distribute the correct key in advance. The delay between receiving the identification of the service key to be used and the encrypted source signal being decrypted with the first key is short to deliver the correct key over the Internet. Too much. Therefore, if the pirate does not fire all the keys that can be used by the pirate, the pirate subscriber will repeatedly see a dark screen depending on the speed of the issued dummy key. With regard to the distribution of all keys that can be used by pirates, the same kind of binary search method as in the prior art is given to find a hacked smart card.
[0007]
According to a further aspect of the method of the invention, a set of search EMMs is sent to the terminal, each search EMM having two keys (P _T and P _D1 , P _T and P _D2 ,..., P _T and P _D2 ). In this manner, the number of iteration steps of the binary search method can be dramatically reduced depending on the size of the search EMM set.
[0008]
As another aspect, a set of search EMMs is sent to at least some of the terminals, each search EMM in the set comprises a different dummy key (P _D ), and each EMM is sent to a different part of the terminal.
[0009]
In this way, one or more breached smart cards used by pirates can be placed in several or just one step, so that legitimate subscribers see a dark screen. This does not invite subscribers' complaints.
[0010]
In yet another aspect of the method of the present invention, the encrypted source signal comprises a stream of data packets, wherein a continuous group includes at least one data packet, and a continuous first key ( C _W1 , C _W2 , ..., C _wi , ..., C _wn ), and each data packet has a first key (C _Wi ) used to decrypt the data packet A dummy key (P _D1 or P _D1 ) used to decrypt the next encrypted first key (C _Wi ) instead of the ECM identifying the service key (P _T ) _D2 ) is sent to the first and second part safety devices of the terminal, respectively, shortly before the first key (C _Wi ) is needed to decrypt the source signal, but the data The packet is encrypted using the previous first key (C _Wi-1 ).
[0011]
In this manner, the pirate is directed to respond to the ECM by transmitting the first key decrypted using the dummy key to the pirate decoder. This false key from a pirate can track a smart card that has been breached. The service provider will immediately scramble the next data packet so that all subscribers can still decrypt this data using the first key previously available in the decoder. The first key is actually used.
[0012]
DETAILED DESCRIPTION OF THE INVENTION
The invention will be further described with reference to the drawing, in which an embodiment of a conditional access system for the broadcast field is shown, in which an embodiment of the method of the invention is implemented.
[0013]
FIG. 1 illustrates a conditional access system for the broadcast field, in which an embodiment of the method of the present invention is implemented.
[0014]
FIG. 2 shows an example of an important hierarchy used in the conditional access system of FIG.
[0015]
In the broadcast field shown, the three broadcasting devices 1-3 are coupled to a multiplexing unit 4 comprising means for scrambled, encoded and compressed broadcast signals provided by the broadcasting device 1-3. The digital data stream thus obtained is multiplexed into a digital transmission stream, for example, in accordance with the MPEG-2 standard. In the illustrated embodiment, it is modulated by the modulator 5 prior to this digital transmission stream transmission. The operator of the device comprising the multiplexing unit 4 and the modulator 5 is responsible for transmitting the signal to a public receiving device, like the single television set 6 shown as an example. Signal transmission can be performed through one or more telecommunications channels including satellite link 7, ground link 8 and cable system 9. One or two or more broadcasting devices 1-3 may be personal broadcasting devices that operate according to the concept of pay television, which means to subscribe. This means that a person who wants a view program broadcast by a specific broadcast device must apply for such a broadcast and pay an appropriate fee.
[0016]
To access any of the broadcast signals provided by the broadcast device 1-3, the conditional access module is usually supplied in the form of a smart card that can be connected to the conditional access module 11 for services that require subscription. 11 and a safety device 12 are required. The rest of the terminal 10 is known as such and no details need to be described.
[0017]
In the application to the broadcasting field of FIG. 1, for example, the broadcasting apparatus 1 may be a pay TV operator using a conditional access system having many subscribers. A terminal 10 having a smart card 12 is provided. Such a conditional access system uses a hierarchy of keys, an example of which is illustrated in FIG. The broadcasting device side is shown on the left in FIG. 2, and the subscriber side is shown on the right. As shown in the figure, the broadcasting apparatus scrambles the source signal by the scrambler 13, where the source signal is scrambled using the first key or the control word _CW . In this way, an encrypted source signal is obtained which is multiplexed by the multiplexer 4. On the subscriber side, the encrypted source signal is decrypted in the decryptor 14 to obtain a clear source signal using the first key C _W. For safety reasons, the key C _W is usually changed at a high speed, for example, every 10 seconds.
[0018]
The control word or first key C _W is sent to the subscriber in a so-called rights control message or ECM, which is scrambled as indicated by reference numeral 15 using the service key P _T. These scrambled ECMs are decrypted at the subscriber side using the same service key PT, which is indicated by reference numeral 16. At a higher level in the hierarchy, the service key is sent in a so-called rights management message or EMM in a scrambled state, which is indicated by the reference number 17 using the group key G and is also scrambled. The EMM is decrypted at the subscriber side using the same group key G, which is indicated by reference numeral 18. Finally, group keys are distributed to subscribers using individual smart card keys and / or smart card addresses. It should be understood that this example key hierarchy is described using only an unrestricted example.
[0019]
Most of the smart cards 12 are distributed among the subscribers of the broadcasting device 1, and these smart cards can block against attacks by illegal persons or pirates trying to extract individual secret keys from the smart cards. Absent. If a pirate can extract an individual key, the pirate can get any key used in the conditional access system and distribute the key over the Internet to subscribers of the pirate network. can do.
[0020]
If the broadcasting device 1 finds that one or more of the smart cards 12 have been breached, it can start searching for one or more smart cards in the following manner.
[0021]
Instead of the normal EMM distribution service key P _T , a special search EMM is sent to the terminal 10, where the search EMM gives the correct service key P _T and an error or dummy key P _D1 to half of the subscribers and is correct It gives the service key P _T and a second dummy key P _D2 to subscribers of the other half. Usually, an identifier for the EMM service key is provided, and similarly, the search EMM also has an identifier for the keys P _T and P _D1 or P _D2 . Of course, these search EMMs are received by both legitimate subscribers and pirates. The service key P _T is just a little before being used to decrypt the control word C _W, ECM is emitted include an identifier indicating the key words correct service key P _T is used to decrypt the control word C _W It is done.
[0022]
The warning issued in advance by the ECM with the identifier of the service key P _T is sufficient to decrypt the control word C _W before the control word is needed to decrypt the encrypted source signal. This indicates that although the pirate also receives the correct service key P _T identifier, the pirate does not have enough time to issue the correct key P _T in advance on the Internet when the ECM is issued. If the pirate does nothing more, the pirate subscriber goes black for an equal number of seconds every few minutes. This means that pirates are directed to issue the keys necessary to decrypt the ECM before it is transmitted. While either of the dummy keys P _D1 or P _D2 is issued, the pirate can be located by the continuous repeated steps as described above.
[0023]
The advantage of the above method is that the smart card 12 at the legitimate subscriber has enough time to use the correct service key to decrypt the control word C _W , so that the legitimate subscriber has a screen. It will never be black.
[0024]
To limit the number of iteration steps, a set of search EMMs can be used, where each set of search EMMs has two keys: a correct key P _T and a dummy key P _T1 or P _D2 or ... P _Dn . provide. Each EMM in the set is sent to another group of smart cards, and the resulting dummy key P _Di indicates the group of smart cards with the smart card that has been breached.
[0025]
Although more complicated for pirates, the following method can be added, in which some features of the encrypted source signal are used. In general, an encrypted data stream is provided with data packets, and each of the next data packet or group of data packets is scrambled using the next first key C _Wi . The header flag of the data packet or group of data packets is such that the terminal 10 knows which one of the given first keys must be used to decrypt the received data packet or group. Indicates the serial number i of the first key used for scrambling. According to the present invention, the ECM is transmitted to indicate that the next key is one of the dummy keys P _D1 or P _D2 . However, the next data packet or group is scrambled using the previous first key C _Wi-1 . Since the pirate cannot distinguish between the different keys and cannot predict whether the instruction using the special key is correct, the pirate is directed to emit a decrypted key using the dummy key. When issuing this decrypted key, the pirate is located by the successive iteration steps described above. On the subscriber side, the control word C _Wi-1 is used according to the header flag of the data packet, and as a result, the terminal operates normally. This method is advantageous when the pirate has a fast response system, whereby the pirate emits an encrypted first key instead of the dummy key itself.
[0026]
In other embodiments of the described method, a breached security device can be tracked using a type of cryptographic technology, where a set of keys can be created, each key having the same encryption Can be deciphered. As an example of this type of encryption, an RSA multiple key encryption algorithm or a secret sharing algorithm can be used. Since such ciphers are not part of the present invention, see Bruce Schneier's Applied Cryptography book, particularly Chapter 23, for further discussion on this type of cipher. For example, the EMM is encrypted using a multi-key algorithm with a set of keys P _i that can decrypt the EMM. Depending on the number of keys in the set and the number of terminals, each terminal or group of terminals is given a different key P _i , so that if the pirate re-broadcasts the key, the source, ie the breached security device Can be tracked. This special kind of cipher can also be applied to the source signal, so that the source signal encrypted with a set of control words C _i instead of one control word C _W can be decrypted.
[0027]
The same result can be obtained with the secret sharing algorithm, but here one or more sharing is required to derive the key needed to obtain the control word. By distributing different assignments to different terminals or groups of terminals, it is possible to track the security devices that have been breached.
[0028]
Note that there must be a large number of keys and shares. By changing the grouping structure, i.e. how the terminals are distributed to several different groups, tracking the breached security device by monitoring the re-broadcast keys or the order of sharing Is possible. The same method of changing the grouping structure can be used for all the above-described embodiments of the present invention.
[0029]
If it is possible to allow a very limited number of legitimate subscribers to get a black screen while searching for a smart card that has been breached, the following method can be used. Special set of search EMM is distributed to all of the smart card, where each group of subscriber receives the wrong service key P _F. Pirates distribute the wrong service key that identifies the group to which the pirated smart card belongs. Within this group in the further steps, it can be seen that a breached smart card can be located by distributing another set of wrong keys within the group.
[0030]
In the described embodiment, the conditional access module 11 and the safety device 12 are shown as physically separated devices. It should be understood that the conditional access module and / or the safety device may be part of the terminal 10 or may be provided in the terminal 10 by appropriate programming. Thus, the terms conditional access module and safety device used in the specification and claims are not limited to physically separate parts.
[0031]
The invention is not limited to the embodiments described above, which can be varied in many ways within the scope of the claims.
[Brief description of the drawings]
FIG. 1 illustrates a conditional access system for the broadcast field, in which an embodiment of the method of the present invention is implemented.
FIG. 2 is a diagram showing an example of important hierarchy used in the conditional access system of FIG. 1;
[Explanation of symbols]
1, 2, 3 ... Broadcasting device 4 ... Multiplexing unit 5 ... Modulator 6 ... Television set 7 ... Satellite link 8 ... Ground link 9 ... Cable system 10 ... Terminal 11 ... Conditional access module 12 ... Safety device

Claims (8)

A method of operating a conditional access system for the broadcast field, comprising:
The conditional access system has many subscribers,
Each subscriber has a terminal including and a safety device conditional access module,
Here, the source signal is encrypted using the first key (Cw),
The first key (Cw) is changed at high speed,
The encrypted source signal is broadcast for the terminal to receive,
A rights control message (ECM) is also sent to the safety device,
The ECM comprises a first key (Cw) encrypted using a service key (P _T ),
In addition, a rights management message (EMM) is sent to the safety device ,
The EMM is characterized by a Turkey to supply service key (P _T) required for decoding the first key that is encrypted (Cw),
A search EMM is sent to at least some of the plurality of subscriber terminals ;
The search EMM supplies at least a service key (P _T ) and a dummy key (P _D1 or P _D2 ),
At least the search EMM comprises an identifier identifying the key (P _T and P _D1 or P _D2 ),
Here, the first search EMM and key (P _T and P _D1) is transmitted to the first portion of the at least a portion of the plurality of subscriber terminals,
And second search EMM and key (P _T and P _D2) is sent to the second portion of the at least a portion of the plurality of subscriber terminals,
Here, ECM identifying the first key service key used to decode (Cw) encrypted (P _T) is required to first key (Cw) is to decode the source signal A method characterized by being transmitted to all safety devices before becoming . The encrypted source signal comprises a stream of data packets,
There, a continuous group contains at least one data packet,
Encrypted using a continuous first key (C _W1 , C _W2 , ..., C _wi , ..., C _wn ),
Each data packet has a flag indicating the first key (C _Wi ) used to decrypt the data packet,
Here, instead of the ECM identifying the service key (P _T ), the dummy key (P _D1 or P _D2 ) used to decrypt the next encrypted first key (C _Wi ) is identified. ECM is, before ing necessary for the first key (C _Wi) is to decode the source signal, but are respectively sent to the safety device of the first and second portions of the terminal,
Method according to claim 1, characterized in that the data packet is encrypted using the previous first key (C _Wi-1 ). A set of search EMMs is sent to at least some of the subscriber terminals ;
3. Each search EMM provides at least a service key (P _T ) and a dummy key (P _D1 , P _D2 ,..., Or P _Dn ) according to claim 1 or 2. Method. A set of search EMMs is sent to at least some of the subscriber terminals ;
As each set of search EMM is different from at least the service key (P _T) dummy key _{(P D1, P D2, ...} , or P _Dn) provides, and,
The method of claim 1, wherein each EMM is sent to a different part of at least some of the plurality of subscriber terminals . Each EMM of the set is sent to a different part of at least some of the subscriber terminals;
The method according to any one of claims 3 or 4 in which the number of search EMM of the set of search EMM is characterized in that it corresponds to the number of different parts of a portion of at least a plurality of subscriber terminals. The source signal or ECM is encrypted using a multiple key or a secret sharing encryption algorithm having a plurality of different decryption keys or shares (Ci; Pi) necessary for decrypting the encrypted source signal or ECM, respectively. And
The plurality of different decryption keys or shares (Ci; Pi) are at least a plurality of subscribers so that different terminals or groups of terminals receive different keys or shares (Ci; Pi) according to a predetermined distribution. Sent to part of the device ,
The method of claim 1, wherein the different shares include information for deriving different keys .   7. A method according to any one of the preceding claims, characterized in that the distribution of terminals within a group of terminals is changed in order to track breached safety devices. Encrypted first key (C _W Service key (P) used to decrypt _T From the transmission of the ECM identifying the first key (C _W ) Is required for the first key (C _W Service key (P) used before) is required to decrypt the source signal _T The method according to any one of claims 1 to 7, characterized in that it is a period during which a pirate cannot supply.

Images